Thanks to the teachers on the road of growth
  Post Categories
Tips 19 Actual combat record 4 Learning record 50 Simple repetition 1
Weak Service Permission Windows Privilege Promotion Weak Service Permission Windows Privilege Promotion
Some of the wordsThe official introduction https://docs.microsoft.com/en-us/dotnet/framework&#x
2021-11-07 Learning record
Redteam Windows Privilege Promotion LPE
Unquoted Service Path Windows Privilege Promotion Unquoted Service Path Windows Privilege Promotion
Some of the wordsIf the target binary Path is not quoted and contains Spaces, the vulnerability name of the installed Se
2021-11-07 Learning record
Redteam Windows Privilege Promotion LPE
Insecure GUI Application Windows Privilege Promotion Insecure GUI Application Windows Privilege Promotion
Some of the wordsElevated privileges in application to try here, part of the GUI application to current higher outside o
2021-11-07 Learning record
Redteam Windows Privilege Promotion LPE
Windows Service Auto Start(BypassAV) Windows Service Auto Start(BypassAV)
前言先前写了下代码层面实现psexec功能点，其中包含建立服务、启动服务功能模块，发现也是个拿来做命令执行或者后门的好方法，此处单独利用windows服务实现开机自启动，增加权限维持杀软对抗思路 先看实现效果，添加服务免杀效果如下 添
2021-11-05 Learning record
Redteam Bypass Windows Service
实现&利用命名管道补充&令牌模拟 实现&利用命名管道补充&令牌模拟
前言上一篇已知命名管道从代码层的基本原理实现，及其实际作战中遭遇反弹shell受阻时的使用方式，此处进步针对实际管道应用中进行展开，补充先前所不足 访问控制命名管道支持跨网络的访问连接，但是会受到访问控制列表或者本地策略的管控 在03及
2021-11-04 Learning record
Redteam Bypass NamedPipes
实现&利用命名管道 实现&利用命名管道
简介命名管道是一个具有名称，可以单向或双面在一个服务器和一个或多个客户端之间进行通讯的管道。命名管道的所有实例拥有相同的名称，但是每个实例都有其自己的缓冲区和句柄，用来为不同客户端通许提供独立的管道。使用实例可使多个管道客户端同时使用相同的
2021-11-02 Learning record
Redteam Bypass NamedPipes
实现一个仿造的Psexec 实现一个仿造的Psexec
前言初衷改变些许的流量特征，增强隐蔽性，此处以进行cs上线为案例，同样能够执行其他exe应用程序，未来或许将增加交互功能 常规痕迹此处查看psexec常规日志&流量中的痕迹，安全日志内登录情况如下，触发多个4624包含相关计算机名
2021-11-01 Learning record
Redteam Bypass Psexec
Fast Open Rdpport(BypassAV) Fast Open Rdpport(BypassAV)
Some of the wordsSome days, I found when I open the RDPport maybe this action will be kill, Special the 360, So I develo
2021-10-12 Learning record
Redteam Bypass RDP
Use Basic Way To BypassUAC Use Basic Way To BypassUAC
前言铺垫于注册表、dll劫持利用的BypassUAC知识，使得基本原理更加简单易懂，具备手动尝试发现思路 UAC简介UAC（User Account Control）是微软在 Windows Vista 以后版本引入的一种安全机制，通过
2021-10-09 Learning record
Redteam Bypass UAC
Use DLL Hijack To BypassUAC(BypassAV) Use DLL Hijack To BypassUAC(BypassAV)
Some of the wordsMy main idea: Hijack the implementation based on the whitelist DLL, thereby bypassuac After a simple t
2021-10-09 Learning record
Redteam Bypass UAC
3 / 5